Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  What is the best way for reverse-engineering DOS/4GW extended EXE file?

Topic created on: May 7, 2010 08:36 CDT by dodamn .

Hello.

I have an EXE file for MS-DOS. It is built by Watcom C/C++ compiler and has DOS/4GW extended format.
I want to reverse-engineer it.

So First, I use IDA pro Hex-ray. But it is my first time for reversing. So I just open the file in IDA pro and just click 'Next', 'Next' and 'Next'. :) But IDA pro is GOD!. It shows assembly code! And I can create .c code using menu 'File'->'Produce file'->'Create C file'. I tried to compile those disassembled/decompiled codes. But it failed.

Second, I use DOSBox. Because DOSBox(debug mode) shows registers' values, assembly code. Also DOSBox provide breakpoint feature. But assembly code what DOSBox shows is not same as IDA pro does. So I can't put breakpoint properly. Why code, what DOSBox shows, is different from what IDA pro shows?

Anyway, what is the best way for reversing DOS/4GW extended EXE file?
Is there any way to put breakpoint on somewhre in the code when the program runs?

  GreenPiece     May 17, 2010 08:08.59 CDT
To debug DOS programs you can try Soft-Ice (as I tried it on Windows 98 and it worked nice, in case of experiencing troubles with WinXP), AFDPro, TurboDebugger, TRW2000.

Results in IDA and debugger may alter because of many reasons, one of them is self-modifying code.

And BTW, never try to produce .exe from what you get from Hex-Rays, there are a lot of errors in this code and if you want to compile it, you'd better refer to IDA disasm-listing.

  jduck     May 17, 2010 12:19.47 CDT
I believe that Gynvael and j00ru have some experience in this area.. http://gynvael.coldwind.pl/ and http://j00ru.vexillium.org/ are their blog links...

I think they even released or plan to release some tools or something to aid in doing this type of reversing.

Note: Registration is required to post to the forums.

There are 31,322 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit